Decisions that kept the checkout open and the customer data small

Declining an A$88 million single cutover for thirty-one reversible releases

In September 2020 the board received a proposal from a consultancy, supported by our chief executive and chief customer officer, to replace Halvorne's commerce platform in one programme. The 2009 application ran the website, checkout, promotions and order management, and it had failed for three hours and ten minutes on Boxing Day 2019, costing an estimated A$7.4 million of online sales. The proposal priced a hosted commerce suite at A$88 million over two years, with a single cutover before Black Friday 2022 and a complete website redesign to launch with it.

I had watched a single cutover fail at Kelderby in 2010, and my objection was not to the vendor. It was that the plan put all of its largest risks on one day, under the heaviest load the new system had ever carried, with no way back. I proposed a routing layer in front of the old application and the migration of one capability at a time, each release reversible within an hour and none scheduled between 1 November and early January.

The chief customer officer disagreed strongly. She would lose the redesign she had promised the board for Black Friday 2022, and my plan meant paying to run two systems for nearly three years. The chief executive wanted tranche funding with release tests. The board approved a first tranche of A$22 million.

We made 31 releases over 34 months and switched off the old application in August 2023. The programme cost A$71 million, including about A$11 million of dual running against my estimate of A$9 million. Online conversion rose from 2.1 per cent in FY2020 to 2.6 per cent in FY2024 and releases went from monthly to about forty a week.

The redesign reached customers in pieces through 2023. Our worst peak incident came from the promotions engine, which I had left until last because it was the most entangled: for four minutes on Boxing Day 2023 an expired promotion showed the wrong price, and we honoured 2,300 orders at a cost of about A$190,000.

I would move the promotions engine earlier, because leaving the hardest piece to the end put our least-tested change on our most valuable day. I would also show the board the full dual-running cost in the first paper rather than in the second tranche.

Taking orders we could not yet charge during a Black Friday gateway failure

At 10.12 am on Black Friday, 29 November 2024, our primary payment gateway began timing out on authorisations. Its status page stayed green for another nineteen minutes. Our second gateway could then carry only about a quarter of peak volume and did not support two of the wallets customers used. At that hour we were taking about A$120,000 of orders a minute.

The response had been argued over a year earlier. In 2023 I proposed a deferred-authorisation mode: accept tokenised card details, confirm the order, and authorise the payment when the gateway recovered. Our head of financial crime opposed it outright, because deferred authorisation invites people to use stolen cards. Our head of e-commerce wanted it open to everyone with no cap. Our chief financial officer wanted a A$1,000 cap and no new customers. We settled on signed-in customers with at least one earlier paid order, baskets up to A$2,500, no gift cards or the most-stolen product lines, and nothing released to a warehouse or collection counter until payment was authorised.

The chief financial officer and I agreed by phone to switch the mode on at 10.18 am. In the 47 minutes before the gateway recovered, it captured 14,300 orders worth A$5.8 million, and the second gateway carried a further A$1.9 million. Of the deferred orders, 96.1 per cent were authorised within four hours. Some 560 orders, worth A$231,000, were declined; we asked those customers to pay again and 61 per cent did. Confirmed fraud cost A$41,000.

The trade-off fell on new customers. About 9,800 sessions from people without an order history were shown a message saying payments were unavailable, and we estimate A$2.2 million of sales went elsewhere.

Afterwards we added service credits measured by our own monitoring to the gateway contract, raised the second gateway's capacity to about 60 per cent of peak before Black Friday 2025 and began rehearsing the mode at full scale every quarter.

I would change two things. The message to new customers should have offered to hold click-and-collect stock for payment in store. And a status-flag error released 212 orders to the warehouse before authorisation; all were paid, but that was luck, and only a full-scale rehearsal would have exposed it.

Deleting 1.7 million identity documents our loss-prevention team wanted to keep

In October 2022, after two very large Australian breaches at a telecommunications company and a health insurer, I asked how many images of customers' identity documents Halvorne held. The answer took eleven days to assemble: about 1.7 million licences, passports, proof-of-age cards and Medicare cards, collected since 2013 from in-store finance applications, from licence photographs taken at click-and-collect for orders over A$2,000, and from commercial account openings. They sat in a document system that 1,140 staff accounts could open.

I proposed to stop photographing documents, record only that identification had been sighted, its type, whether the name matched and who checked it, and delete the archive. Our head of loss prevention disagreed. Images helped police pursue organised click-and-collect fraud, which cost us about A$3.1 million a year, and he estimated that losing them would add A$1.2 million a year. Our commercial credit manager needed directors' identification for trade accounts backed by personal guarantees. The chief financial officer asked us to measure and report the fraud cost.

We stopped capturing images in February 2023. For high-value collections we sent a one-time code to the mobile number verified at checkout and allowed collection only by the purchaser or a nominee named at checkout. Trade-account documents moved to a separate store with fourteen authorised users and a destruction date tied to account closure. We set aside 2,300 images linked to disputes, police matters or legal holds, and deleted the rest in waves between July 2023 and May 2024, each confirmed by internal audit. We also de-identified 4.6 million customer records with no purchase for more than seven years.

Click-and-collect fraud rose by about A$420,000 in FY2024, then fell back once the collection code had bedded in. Our worst-case breach exposure across customer systems fell from about 6.1 million people to about 1.9 million by mid-2025. Each class of personal data now has a named owner and a deletion date, the audit and risk committee reviews exceptions every year, and no new system goes live without a deletion design.

I would search mailboxes and file shares first. Six months after the main deletion we found a further 210,000 images that staff had emailed to one another, and they were not removed until February 2025.

Keeping the customer-service assistant away from faulty-product claims

In early 2024 our contact centre, about 620 agents across our own team and an outsourced partner, handled 3.4 million contacts a year, 41 per cent of them asking where an order was. A vendor proposed a generative assistant for chat and messaging that would resolve 65 per cent of contacts, including returns and fault claims, and save about A$9.5 million a year. Our general manager of customer contact and our chief financial officer both supported the full scope.

Before deciding, I asked our frontline agents to write 1,200 test conversations. Two hundred and forty were fault claims. In nine, the assistant told a customer that a product was outside the manufacturer's warranty and that nothing more could be done. Under Australian Consumer Law, consumer guarantees of acceptable quality can apply after a manufacturer's warranty has ended, so that answer could mislead a customer about rights they hold. In testing it also offered delivery dates that no carrier had given us in about 3 per cent of delivery conversations.

In March 2024 I recommended a narrower assistant: delivery questions answered only from carrier data, store stock, opening hours and product specifications from our product database, each with a cited source, and every mention of a fault, return, refund or warranty passed to a person with a summary of the conversation, the order and the product's history. The general manager of customer contact accepted it reluctantly. The chief financial officer pressed me on the savings, and he was right to.

We launched in June 2024. In the first quarter containment was 44 per cent, but only 31 per cent of contacts were resolved without the customer returning within seven days, and we have reported the second figure ever since. The assistant now saves about A$3.6 million a year, roughly A$5.9 million less than the proposal. Customers rate the conversations it resolves at 4.2 out of 5. Handling time on fault claims fell 22 per cent because agents receive the summary, and fault-claim complaints escalated to our customer relations team fell 17 per cent. We have since widened the assistant once, to rescheduling deliveries.

I would measure recontact from the first day instead of discovering it in the first quarter's figures, and I would bring the frontline agents in before the vendor demonstration rather than after it.